Webspace archived due to being over its 24h bandwidth quota

[#1]

I've been with Plusnet for 12 years. With the package I bought when I joined came 250MB webspace which I have used without problems until today (4 June 2021), subdomain dheaf.plus.com. This morning I received a Plusnet message saying "117702 KB OVER its bandwidth transfer allowance during the last 24 hours" and the site has been archived. 

While Plusnet staff are trying to sort this, I thought I'd try to find out which files caused the excess bandwidth. Unfortunately there are no stats visible in my console. Would they have been archived too?

Does anyone have any suggestions for stopping this happening in future?

[#2]

Moderators Note

This topic has been moved from ADSL Broadband to Everything Else

[#3]

Thanks for your post @davidheaf and welcome to our Community Forums.

I've firstly checked the task we've raised and corrected a few things which means it should be picked up by our NetOps team early next week to unarchive your webspace (normally within 3 working days)

The webstats shouldn't be archived as far as I'm aware, are you able to access them through the steps Here?

[#4]

Thanks for your help Gandalf. You asked "The webstats shouldn't be archived as far as I'm aware, are you able to access them through the steps Here?"

In the webspace manager the stats are activated. I got as far as the following instructions:

"View your Webstats
The following domains are hosted on your PlusNet account. Choose a domain from the list below and enter your username and password in the popup window that appears. For more information on the graphs and statistics, please see below.
www.dheaf.plus.com"

When I clicked on the domain name a sign-in form appeared, even though I was already signed in. Anyway, I signed in as it requested but it returned the same form, only empty. So I tried old passwords. The one I use for FTP also failed but the oldest password from 12 years ago worked!

I attach just one table from the copious and helpful data. Clearly there was a spike in usage on 3 June. I will examine the stats in detail to see what has attracted so much interest. Maybe popular files will have to be deleted.

[#5]

Thanks for getting back to me @davidheaf 

Really odd but glad to see you've signed-in OK in the end. Try requesting a new password through the forgot password tool, if you'd want to use a new one rather than the old one. 

[#6]

Happily, dheaf.plus.com was restored this morning. I have removed a couple of files which seem overly popular, but for a belt-and-braces prevention of future bandwidth overload, I need to know what the quota is for my accoint. In PlusNet's auto email announcing that the site was archived it said:

"Your website used 117702 KB OVER its bandwidth transfer allowance during the last 24 hours. You may be interested in upgrading to an account with a higher bandwidth quota; details of the bandwidth allowances are available on our website at the following URL: http://www.plus.net/support/webspace/tips_and_info/webspace_faq.shtml#9 "

That link returns a 404 error. Does anyone know if the file still exists and where?

Another puzzling thing is that the figure of 117702 KB is identical to the KB transferred on 3 June, the day before the site was archived, as shown in the site's statistics. The implication is that there was no bandwidth transfer allowance on that day. How is this explained?

[#7 · Accepted solution]

Yep, I can confirm that we restored your website yesterday morning.

You'd get 250MB of storage allowance and 250MB of daily transfer allowance for our webspace services.

Unfortunately as webspace is a legacy product with us especially for home broadband that'd be the max you can get.  Looking Here the allowances should be listed in the Website Settings on your account.

With regards to being over the limit, we're aware of an issue that we've archived some folks' webspace basically in error, so your website may had got caught up in this.

I'd since discussed this with a colleague from our NetOps team and I've not been able to find out what's caused it, but we believe it may be related to some maintenance work we've done (They're investigating further so we can try to make sure that this doesn't happen again though)

Really sorry for the time you've been without your site. Let me know if there are any further issues.

[#8]

I'd like to add that my website was archived too. I'm not happy that the URL given for the "Webspace FAQ" gave a "404".

It appears as if a small number of "zip" files recieved an excessive level of activity. Given time I might be able to extraxt more information from the logs.

Yesterday I recieved four rather unpleasant emails from "Netcraft Takedown Service" claiming

You are currently hosting a site which is associated with an ongoing malware attack. The malware is either spread via an email with a malicious attachment, which when run, appears to communicate with the following links; or it is spread directly using the following malicious links:

This seems unlikely as there is no evidence to suggest the file is anything other than a zip file containing an old "gamemaker" game.

[#9]

Thanks for your post @oliverab and welcome to our Community Forums

I'm sorry for the difficulties you've had with finding out information about your webspace.

I've raised a task with our NetOps team now to unarchive, which should be done within the next 3 working days and I'll provide an update as soon as I know more.

[#10]

Thanks for the assistance. I've downloaded one of the logfiles, but I'm out of practice at diagnosing this kind of thing. It does look as if after restoration two files may need to be removed, renamed or hidden. The files were "pose2c.zip" and "pose2d.zip".

Both files have been subject to excessive activity. I believe they're of only minor interest now as they are in an obsolete file format, so I may just remove all links to them altogether,

I seem to recall there was a way to configure the site to check the referring URL and prevent download if the referrer was wrong. Historically this would have been used for images, but maybe I need to do the same for zip files.

[#11]

Thanks for getting back to me @oliverab 

No problem, I'll let you know once your site's back up and running.

[#12]

For anyone else interested: The site was restored successfully. I am continuing to see repeated attempts by four Digital ocean IP addresses to download two files. I've added a "deny from" line in my .htaccess file, and according to my latest logfile they are now getting "403" forbidden errors.

[#13]

Thanks for the update @oliverab 

Incidentally that's what our NetOps team have told me this morning for you to do. 

Let me know if there are further issues or anything else you'd need help with.